cgsecurity.org

Posted: **18 Mar 2015, 19:57**

Hi,

I have a corrupted 8GB, sandisk mini SDHC card. Few days ago, my android phone gave me an error to reformat my sd-card. I took it off and connected to my PC via adapter. However, it took few minutes before my PC recognized it. After I got a sound notification, I tried to access my files through "My PC", then, explorer.exe got freeze, and I couldn't open it.

I tried some recovery tools, but not a chance. I found this program, and tried. It got few minutes before it found my sd-card. I tried QPhotoRec.exe. While it was searching for sd-card, the program froze few times. It has been 66 hours now, and it's stil in Pass 0: Reading Sector part. It did not find any files yet. I started to wonder why this is taking forever? Is this even normal?

BTW, the program is often frozen, and takes some time to running again (3-5 secs "running", 40-60 secs frozen in a cycle). I have Win 8.1 Pro, 16GB ram, i7 4710q cpu and am using the latest version of the program. The screen as follows.

Please tell me what is wrong???

: qpic.JPG (80.94 KiB) Viewed 13459 times

Posted: **19 Mar 2015, 09:29**

Looks like a hardware problem, you need to contact a data recovery company.

Posted: **20 Mar 2015, 06:36**

It didn't stop though? Well, I found the log file, and it seems it keeps getting this error "read err: read after end of file" each time. Any idea why and what does it mean? I am stil running the program, and attached the log file. I don't intend to send it to any company, as there aren't any important stuff, only photos.

So, would you at least try to help a little? What is going wrong and what else I can try? I haven't tried testdisk.exe for example. Are there any other options?

Code: Select all

Mon Mar 16 20:35:49 2015
PhotoRec 7.0-WIP, Data Recovery Utility, March 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.9, MinGW 3.11
Compilation date: Mar  9 2015 19:50:05
ext2fs lib: none, ntfs lib: 10:0:0, ewf lib: 20120504, libjpeg: libjpeg-turbo-1.3.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1000204886016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=7822376960
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=998203457536
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=0
Fix disk size using CHS
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\F:
Partition table type (auto): Intel
Disk \\.\PhysicalDrive0 - 1000 GB / 931 GiB (RO)
Geometry from i386 MBR: head=255 sector=63
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
     No partition             0   0  1 121601  80 63 1953525168 [Whole disk]
 1 * FAT32                    0   1  1   242 254 63    3903732
     FAT32, blocksize=4096, 1998 MB / 1906 MiB
 2 P HPFS - NTFS            243  27 41 121601  25 24 1949616128
     NTFS, blocksize=4096, 998 GB / 929 GiB

win32_pread(436,897,buffer,1559113(97/12/53)) read err: read after end of file
file_win32_pread(436,897,buffer,1560010(97/27/5)) read err: read after end of file
file_win32_pread(436,897,buffer,1560907(97/41/20)) read err: read after end of file
file_win32_pread(436,897,buffer,1561804(97/55/35)) read err: read after end of file
file_win32_pread(436,897,buffer,1562701(97/69/50)) read err: read after end of file
file_win32_pread(436,897,buffer,1563598(97/84/2)) read err: read after end of file
file_win32_pread(436,897,buffer,1564495(97/98/17)) read err: read after end of file
file_win32_pread(436,897,buffer,1565392(97/112/32)) read err: read after end of file
file_win32_pread(436,897,buffer,1566289(97/126/47)) read err: read after end of file
file_win32_pread(436,897,buffer,1567186(97/140/62)) read err: read after end of file
file_win32_pread(436,897,buffer,1568083(97/155/14)) read err: read after end of file
file_win32_pread(436,897,buffer,1568980(97/169/29)) read err: read after end of file
file_win32_pread(436,897,buffer,1569877(97/183/44)) read err: read after end of file
...
...
...
file_win32_pread(436,897,buffer,7702666(479/119/35)) read err: read after end of file
file_win32_pread(436,897,buffer,7703563(479/133/50)) read err: read after end of file
file_win32_pread(436,897,buffer,7704460(479/148/2)) read err: read after end of file
file_win32_pread(436,897,buffer,7705357(479/162/17)) read err: read after end of file
file_win32_pread(436,897,buffer,7706254(479/176/32)) read err: read after end of file
file_win32_pread(436,897,buffer,7707151(479/190/47)) read err: read after end of file
file_win32_pread(436,897,buffer,7708048(479/204/62)) read err: read after end of file
file_win32_pread(436,897,buffer,7708945(479/219/14)) read err: read after end of file
file_win32_pread(436,

Posted: **20 Mar 2015, 06:43**

I think Im having the same problem as you, except mine has been running for 2 weeks now since I've been unable to get any help. I've restarted several times, but recently started taking screen grabs to track my progress:

I've got a 1TB drive:

The program runs to about sector 530,000,000 at normal speed then slows down to only a few sectors every hour. It appears the program is "stuck" since nothing updates, but then every 30 minutes or so it will find a new file. As you can see between the last two images (24 hours apart) only a few 100 sectors were processed.

Posted: **20 Mar 2015, 06:57**

Where did you find the log file, I can't find mine?

Posted: **20 Mar 2015, 15:31**

ag25 wrote:I think Im having the same problem as you, except mine has been running for 2 weeks now since I've been unable to get any help. I've restarted several times, but recently started taking screen grabs to track my progress:

I've got a 1TB drive:

The program runs to about sector 530,000,000 at normal speed then slows down to only a few sectors every hour. It appears the program is "stuck" since nothing updates, but then every 30 minutes or so it will find a new file. As you can see between the last two images (24 hours apart) only a few 100 sectors were processed.

Seems similar, but you are luckier. You've been able to recover some files, I haven't. You say it stuck after some point, mine has been freezing all the time. You are using PhotoRec.exe, I use QPhotoRec.exe. I don't think, it is same though

ag25 wrote:Where did you find the log file, I can't find mine?

Log file is in the same folder as my software. It's created when I started the software. It has the same name as my software, in my case: QPhotoRec.log. It's updating in each sector. However, I started PhotoRec-win.exe and had the following screen; and couldn't find any log files, even though it created a folder called recup_dir.1.

: qq.JPG (42.91 KiB) Viewed 13424 times

Good luck!

Posted: **23 Mar 2015, 11:38**

It's not a good idea to cross post with two different problems.

ekarden - As the admin says, it looks like your original media has a major defect, you will need to go to a specialist data recovery company to sort this out.

ag25 - It looks as there may be some surface errors on your drive holding your image - or maybe dd copied over errors from your original drive. I would start again using a different collection drive and image the original drive with ddrescue to try and reduce any corrupted data being copied over into your image file.

Posted: **24 Mar 2015, 03:53**

stumpyuk wrote:It's not a good idea to cross post with two different problems.

ekarden - As the admin says, it looks like your original media has a major defect, you will need to go to a specialist data recovery company to sort this out.

ag25 - It looks as there may be some surface errors on your drive holding your image - or maybe dd copied over errors from your original drive. I would start again using a different collection drive and image the original drive with ddrescue to try and reduce any corrupted data being copied over into your image file.

The drive holding my image is brand new.
The results I have a repeatable regardless of the drive holding the image.
The results are the same when running PhotoRec directly from the physical drive. I made the image only after I was having problems with the drive.

My drive was perfectly healthy to my knowledge. I'm doing recovery on an accidentally formatted drive.

Posted: **24 Mar 2015, 10:17**

ag25 wrote: The results are the same when running PhotoRec directly from the physical drive.

Ah! This indicates that there are surface errors on your physicial drive. You need to use ddrescue to image the drive, then run photorec.

Stumpy

Posted: **25 Mar 2015, 03:29**

stumpyuk wrote:
ag25 wrote: The results are the same when running PhotoRec directly from the physical drive.
Ah! This indicates that there are surface errors on your physicial drive. You need to use ddrescue to image the drive, then run photorec.

Stumpy

Okay, I can try this.

Is there site that can walk me through the process for a windows machine?

cgsecurity.org

QPhotoRec takes forever in Pass 0: Reading Sector

QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector

Re: QPhotoRec takes forever in Pass 0: Reading Sector